Enhanced due diligence is one of the most operationally demanding elements of an iGaming AML programme. Regulators across Malta, Gibraltar, the UK and the Netherlands are issuing larger fines and more frequent licence reviews, and the trigger points are almost always the same: operators set EDD thresholds incorrectly, apply them inconsistently or document the outcomes so poorly that auditors have nothing meaningful to review.
What Enhanced Due Diligence Actually Requires
EDD is a deepened customer verification process applied when standard CDD measures are insufficient to manage the risk a player or business relationship presents. In iGaming, that risk elevation typically stems from deposit velocity, source-of-funds ambiguity, politically exposed person status, high-risk jurisdiction flags or unusual behavioural patterns. EDD is not simply asking for a payslip; it is a structured investigation that must produce a documented risk conclusion and, where relevant, senior management sign-off.
Mistake 1: Treating Thresholds as Absolute Rules
The single most common error is treating a monetary threshold as a binary trigger. Operators set a figure, often 2,000 EUR in deposits within 30 days, and assume that players below it require no additional scrutiny. Regulators reject this model because risk is not linear. A player depositing 1,800 EUR per month across six accounts, or one who deposits 500 EUR but withdraws within minutes repeatedly, presents obvious risk signals that a flat threshold will miss entirely.
The practical fix is to layer thresholds with behavioural rules. A threshold should be a prompt for review, not the sole determinant of whether EDD applies. Combine deposit ceilings with velocity checks, win/loss ratio anomalies and session-length outliers.
Mistake 2: Inconsistent Application Across Player Segments
Many operators apply EDD rigorously to high-value VIP players because those relationships are visible to commercial teams, yet allow mid-tier players to accumulate substantial lifetime deposits without any enhanced review. Regulators do not accept a risk framework that protects business relationships at the expense of compliance consistency. If your EDD policy says it applies at a certain threshold, it must apply to every player who meets that criterion, regardless of commercial value.
Operators should audit their EDD completion rates by player segment quarterly. A significant gap between VIP and general-population EDD rates is a reliable indicator that the programme has a structural flaw.
Mistake 3: Weak Source-of-Funds Verification
Accepting a bank statement screenshot as sufficient source-of-funds evidence is a widespread shortcut. A screenshot confirms a balance at a point in time; it does not explain how that balance was accumulated. Regulators, particularly the UK Gambling Commission and the MGA, expect operators to understand the origin of wealth in proportion to the risk the player presents.
- For salaried players, a recent payslip alongside three months of bank statements is a reasonable baseline.
- For self-employed or business-owner players, accounts, tax returns or director-level company documentation are appropriate.
- For players citing investment income, third-party statements from the relevant institution add necessary corroboration.
The key principle is proportionality: the more the player's activity deviates from their stated income, the stronger the documentary evidence must be.
Mistake 4: Poor Documentation of EDD Outcomes
An EDD process that produces no auditable record is almost as problematic as no EDD at all. If a regulator reviews a player file and finds only a checklist saying "documents received," that is not a risk conclusion. The file must show what was reviewed, what questions were raised, what answers were provided and what decision was made, including who made it and why.
EDD documentation should be able to answer one question clearly: if this player later appeared in a money laundering case, could you demonstrate that your team identified the risk, investigated it proportionately and made a reasoned decision?
Mistake 5: Failing to Reassess After Initial EDD Clearance
EDD is not a one-time gate. A player cleared at the 2,000 EUR threshold who subsequently deposits 15,000 EUR over the following quarter has materially changed their risk profile. Operators need periodic reassessment triggers built into their player monitoring systems so that EDD does not become a historical artefact that no longer reflects current behaviour.
Building a More Resilient EDD Framework
Operators who get EDD right share several characteristics: they maintain a written risk appetite statement that defines what triggers EDD at every tier, they train their compliance teams on what acceptable evidence looks like for different income types, and they review their threshold calibration at least annually against their actual player data. Compliance is a continuously maintained posture, not a configuration set once at launch.
